[keycloak-user] how to decode RPT from entitlement API